With cluster IP, traffic is masquraded only when --masquerade-all option is specified or --cluster-cidr is specified and the source is not from the cluster CIDR range https://github.com/kubernetes/kubernetes/blob/v1.14.2/pkg/proxy/iptables/proxier.go#L842